Hello Patrick,
On 2015-05-26 22:24, P. Wagner wrote:
I'm wondering how Piler can protect against tampering with mails?
As far as I understand, Piler encrypts all messages with Blowfish
(symmetrical encryption, key derived from piler.key coupled with
initialization vector taken from iv=... setting in piler.conf) and
creates checksums for header and body that are stored in the metadata
table in SQL,
so something like filesystem corruption or simply replacing a file
(without touching the database) will be noticed upon retrieval.
That leaves only the SQL database as the (inevitable?) weak spot, as I
can easily let mails disappear or replace an existing mail with
arbitrary content (as long as I remember to update the checksums in
the corresponding metadata table row).
(Solution: regularly dump SQL database to WORM mediums to be able to
spot such malicious attempts?)
Is all of that correct or am I wrong somewhere?
you are right. Since piler is an open source tool, unfortunately even
obfuscation can't help much about it. The trouble is that a malicious
administrator virtually can't be stopped to mess the piler database.
So any protection you should must be outside the box. Eg. you may use
shell control box to register everything an admin does via ssh. Or
you may use a worm drive to prevent the modification of the messages
(though you still have to protect the piler database. And you may use
rfc3161 timestamping (see the website for more details) to spot any
tampering.
And at last, but not least you should implement heavy logging to be
able to reconstruct who sabotaged the archive.
If you have an idea about how to secure the archive even further, then
let me know.
Janos
PS: once I asked the same question to the salesperson of a commercial
archiving product, and they admitted tamper-proof is more like a
marketing
buzzword (a bullshit if you like). They consider their product
tamper-proof
because it makes very difficult such a modification to happen. Not to
mention
the undocumented format of how they organise the data files.
